Read the docs
TI-2018-04722 Aliases CVE-2018-6409GHSA-7m97-g8f2-fj9g

An issue was discovered in Appnitro MachForm before 4.2.3.

Priority LOW 39CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

An issue was discovered in Appnitro MachForm before 4.2.3. The module in charge of serving stored files gets the path from the database. Modifying the name of the file to serve on the corresponding ap_form table leads to a path traversal vulnerability via the download.php q parameter.

Why it matters now

EPSS 0.13832 96th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:machform:machform:4.2.3:*:*:*:*:*:*:*4.2.3VulnerableMachform
  • cpe:2.3:a:machform:machform:4.2.3:*:*:*:*:*:*:* Versions 4.2.3 Vulnerable ·Machform

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-6409
  2. 2026-10-03 Alias added: GHSA-7m97-g8f2-fj9g

References

Exploit 2

Advisory 1

  • TI-2024-25139 Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page. CVSS 3.1HIGH 8.8
  • TI-2024-25136 MachForm up to version 21 is affected by an authenticated unrestricted file upload which… CVSS 3.1CRITICAL 9.9
  • TI-2024-25138 MachForm up to version 19 is affected by an authenticated stored cross-site scripting. CVSS 3.1MEDIUM 5.4
  • TI-2024-25137 MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting… CVSS 3.1MEDIUM 5.4
  • TI-2018-04724 An issue was discovered in Appnitro MachForm before 4.2.3. CVSS 3.0CRITICAL 9.8
  • TI-2018-04723 An issue was discovered in Appnitro MachForm before 4.2.3. CVSS 3.0CRITICAL 9.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences